Описание
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
Summary
The webhook_url field in the Jobs API silently passes validation when DNS resolution fails (socket.gaierror), enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.
Details
The validator catches socket.gaierror and silently allows the URL:
The HTTP call is made later with no re-validation:
Proof of Concept
DNS rebinding flow:
- Register
attacker.comwith TTL=1s → resolves to1.2.3.4(public IP) - Submit job:
webhook_url=http://attacker.com/callback - Validation passes (public IP)
- Switch DNS:
attacker.com→127.0.0.1 - Job completes → server POSTs to
127.0.0.1→ internal SSRF
Unresolvable domain bypass (no DNS rebinding required):
Impact
SSRF to internal HTTP services: admin panels, databases, and cloud metadata APIs (e.g., http://169.254.169.254/). Exploitable without authentication.
Пакеты
PraisonAI
<= 4.6.48
4.6.58
Связанные уязвимости
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.